ISTQB Advanced Level Technical Test Analyst (CTAL-TTA)

What does McCabe's cyclomatic complexity measure for a piece of code?

• AThe number of lines in the code
• BThe number of linearly independent paths through the code
• CThe number of variables used
• DThe number of comments

For a function with 3 if-else statements (no nested), what is the cyclomatic complexity?

• A1
• B3
• C4
• D6

Which white-box coverage criterion requires that every branch of every decision is exercised at least once?

• AStatement coverage
• BDecision/branch coverage
• CCondition coverage
• DPath coverage

For the condition (A AND B) OR C, how many test cases are needed for full Modified Condition/Decision Coverage (MC/DC)?

• A2
• B4
• CApproximately N+1 where N is the number of conditions (so 4)
• D8 (all combinations)

Which type of analysis examines code WITHOUT executing it?

• ADynamic analysis
• BStatic analysis
• CPerformance testing
• DSecurity penetration testing

Which of the following is a typical finding from data flow analysis?

• AMemory leaks
• BAnomalies such as defining a variable but never using it (du anomaly)
• CPerformance bottlenecks
• DSlow database queries

Which security vulnerability is exploited when user input is included in SQL queries without proper sanitization?

• ACross-site scripting (XSS)
• BSQL injection
• CCross-site request forgery (CSRF)
• DBuffer overflow

Which non-functional testing type is BEST for determining the maximum number of concurrent users a system can handle?

• AStress testing
• BLoad testing
• CCapacity testing
• DRecovery testing

Which performance testing type pushes the system beyond its designed limits to observe failure behavior?

• ALoad testing
• BStress testing
• CCapacity testing
• DSmoke testing

Which OWASP vulnerability allows an attacker to execute scripts in a victim's browser?

• ASQL injection
• BCross-site scripting (XSS)
• CInsecure deserialization
• DBroken authentication

What does MTBF stand for in reliability testing?

• AMaximum Time Before Failure
• BMean Time Between Failures
• CMinimum Tested Build Failure
• DMedian Test Bench Failure

Which dynamic analysis technique identifies variables that are referenced before being assigned a value?

• AMemory leak detection
• BWild pointer detection
• CUninitialized variable detection
• DPerformance profiling

Which open-source tool is commonly used for performance and load testing?

• ASelenium WebDriver
• BApache JMeter
• CJaCoCo
• DOWASP ZAP

In API testing, which HTTP status code typically indicates the requested resource was not found?

• A200
• B301
• C404
• D500

Control flow analysis primarily identifies:

• AMemory consumption patterns
• BUnreachable code, infinite loops, and decision-point complexity
• CUser interface defects
• DDatabase performance issues

Which security testing approach involves attempting to exploit vulnerabilities to verify the system's defenses?

• AStatic application security testing (SAST)
• BPenetration testing
• CCode review
• DSoftware composition analysis (SCA)

Which metric is calculated by JaCoCo, Cobertura, or Istanbul?

• ACyclomatic complexity
• BCode coverage (line, branch, instruction)
• CMemory leaks
• DNetwork latency

Which testing type verifies the system's ability to recover from failures (e.g., crashes, network outages)?

• AStress testing
• BRecovery testing
• CCapacity testing
• DCompatibility testing

For a system with high cyclomatic complexity (e.g., V(G) = 30) in a single function, the recommendation is typically to:

• AAdd more comments
• BRefactor the function into smaller, simpler functions to reduce complexity
• CAdd more tests only
• DRemove all conditional logic

Which of the following is the BEST tool for security testing of web applications?

• AJaCoCo
• BOWASP ZAP
• CJMeter
• DSelenium

In ISO/IEC 25010, which characteristic includes 'modularity', 'reusability', 'modifiability', and 'testability'?

• AReliability
• BMaintainability
• CPortability
• DCompatibility

Which testing approach uses keywords that represent test actions, allowing non-technical users to design tests?

• ALinear scripting
• BData-driven testing
• CKeyword-driven testing
• DBehavior-driven development (BDD)

BDD frameworks like Cucumber and SpecFlow use which keywords for test scenarios?

• ASetup, Test, Cleanup
• BGiven, When, Then
• CArrange, Act, Assert
• DPlan, Execute, Verify

What is the PRIMARY purpose of statement coverage?

• AVerify each statement is executed at least once
• BVerify all decisions take both true and false outcomes
• CVerify all paths through the code
• DVerify all conditions are evaluated

In a 'def-clear path' between a definition and use of variable X, what does 'def-clear' mean?

• AThe path has no other variables
• BThe path does not contain any redefinition of X between the original definition and the u…
• CThe path executes quickly
• DThe path has no errors

Which performance metric measures the time from request submission to first response?

• AThroughput
• BLatency (response time)
• CCPU utilization
• DMemory consumption

In dynamic analysis, which tool category detects memory leaks during execution?

• ALinters
• BMemory profilers (e.g., Valgrind, AddressSanitizer)
• CCode coverage tools
• DUI automation tools

Which testing technique is MOST appropriate for verifying scalability — that the system handles increasing load while maintaining performance?

• AStress testing
• BScalability testing (gradually increasing load with proportional measurement)
• CVolume testing
• DSmoke testing

Which tool is commonly used for API testing and supports both manual exploration and automated test scripts?

• AJaCoCo
• BPostman
• CCobertura
• DJMeter only

Which technique determines the minimum set of test cases required to cover all linearly independent paths through code?

• AStatement coverage
• BDecision coverage
• CBasis path testing
• DBoundary value analysis

What is the PRIMARY purpose of a security smell detector in static analysis?

• ATo find performance bottlenecks
• BTo identify code patterns that may indicate security vulnerabilities
• CTo check coding style
• DTo measure cyclomatic complexity

For a system that must work on Windows, macOS, and Linux, which type of testing is essential?

• AStress testing
• BCompatibility/portability testing
• CRecovery testing
• DVolume testing

For modified condition/decision coverage (MC/DC) of (A AND B), if test cases are A=T,B=T (out=T), A=T,B=F (out=F), A=F,B=T (out=F), is this sufficient for MC/DC?

• ANo — need 4 test cases
• BYes — each condition is shown to independently affect the outcome
• CNo — need only 2 test cases
• DYes — but only for statement coverage

Which test automation tool is the open-source standard for browser-based UI test automation?

• AJMeter
• BSelenium WebDriver
• CPostman
• DJaCoCo

Wild pointers in C/C++ are pointers that:

• AMove randomly through memory
• BPoint to memory that has been freed or never properly initialized
• CAre properly typed but unused
• DAre encrypted

Which OWASP vulnerability allows an attacker to trick a logged-in user into performing actions they didn't intend?

• ASQL injection
• BCross-site request forgery (CSRF)
• CBroken access control
• DSecurity misconfiguration

In API testing, which technique should be used to verify the system handles unexpected request formats gracefully?

• AOnly positive testing
• BNegative testing with malformed JSON, missing fields, wrong types
• COnly load testing
• DOnly static analysis

Which static analysis finding indicates code that can never be executed?

• AHigh cyclomatic complexity
• BDead code
• CCode smell
• DLong method

For a function with cyclomatic complexity V(G) = 5, what is the MINIMUM number of test cases needed for basis path coverage?

• A1
• B3
• C5
• D10

Which tool is BEST suited for mobile application test automation across iOS and Android?

• ASelenium WebDriver
• BAppium
• CPostman
• DJaCoCo

In condition coverage, what must each Boolean sub-expression do?

• ABe evaluated as a complete expression
• BTake both true and false values during testing
• CHave a comment
• DBe tested with equivalence partitions

Which performance testing tool uses Scala and provides high concurrency with low resource use?

• AJMeter
• BGatling
• CSelenium
• DJaCoCo

Which technical risk is BEST mitigated through code reviews and static analysis?

• ANetwork bandwidth limitations
• BCoding standards violations and security vulnerabilities visible in source code
• CHardware failures
• DUser experience design issues

Which testing technique focuses on the EFFICIENCY of resource usage during execution?

• AReliability testing
• BEfficiency/Performance testing
• CMaintainability testing
• DFunctional testing

Which test framework was specifically designed for TestNG-like Java unit and integration testing?

• AJUnit
• BCucumber
• CSelenium
• DPostman

What is a 'def-use pair' in data flow analysis?

• AA variable defined and used in the same line
• BAn association between a definition (def) of a variable and a use of that variable
• CTwo definitions of the same variable
• DA variable used in two functions